diff mbox

[PATCHv4,4/4] Adding seccomp calls to vl.c

Message ID 98962f4d0fbdbc4363b813c8e18072eb7628bf48.1342552002.git.otubo@linux.vnet.ibm.com
State New
Headers show

Commit Message

Eduardo Otubo July 17, 2012, 7:19 p.m. UTC 
v1:
 * Full seccomp calls and data included in vl.c

v2:
 * Full seccomp calls and data removed from vl.c and put into separate
   qemu-seccomp.[ch] file.

v4:
 * Call to install_seccomp_syscall_debug() added.
 * Now calling seccomp_start() with 'SECCOMP_MODE' argument, depending on
   settings used in configure script.

Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
---
 vl.c |   31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
diff mbox

Patch

diff --git a/vl.c b/vl.c
index 46248b9..8dc9432 100644
--- a/vl.c
+++ b/vl.c
@@ -62,6 +62,14 @@ 
 #include <linux/ppdev.h>
 #include <linux/parport.h>
 #endif
+
+#ifdef CONFIG_SECCOMP
+#include "qemu-seccomp.h"
+#endif
+#ifdef CONFIG_SECCOMP_DEBUG
+#include "qemu-seccomp-debug.h"
+#endif
+
 #ifdef __sun__
 #include <sys/stat.h>
 #include <sys/ethernet.h>
@@ -169,6 +177,14 @@  int main(int argc, char **argv)
 
 #define MAX_VIRTIO_CONSOLES 1
 
+#ifdef CONFIG_SECCOMP
+#ifdef CONFIG_SECCOMP_DEBUG
+#define SECCOMP_MODE SCMP_ACT_TRAP
+#else
+#define SECCOMP_MODE SCMP_ACT_KILL
+#endif
+#endif
+
 static const char *data_dir;
 const char *bios_name = NULL;
 enum vga_retrace_method vga_retrace_method = VGA_RETRACE_DUMB;
@@ -2295,6 +2311,21 @@  int main(int argc, char **argv, char **envp)
     const char *trace_events = NULL;
     const char *trace_file = NULL;
 
+#ifdef CONFIG_SECCOMP_DEBUG
+    if (install_seccomp_syscall_debug()) {
+        fprintf(stderr, "seccomp: failed to install system call debug\n");
+        exit(1);
+    }
+#endif
+
+#ifdef CONFIG_SECCOMP
+    if (seccomp_start(SECCOMP_MODE) < 0) {
+        fprintf(stderr,
+                "seccomp: failed to install syscall filter in the kernel\n");
+        exit(1);
+    }
+#endif
+
     atexit(qemu_run_exit_notifiers);
     error_set_progname(argv[0]);